FortiGate Performance Optimization: Tuning Guide for

# Overall system status -- CPU, memory, firmware, uptime
get system status
 
# Real-time CPU usage per core
get system performance status
 
# Detailed CPU usage breakdown (user, system, idle, interrupt)
diagnose sys top 1 20
 
# Memory usage summary
diagnose hardware sysinfo memory
 
# Current session count vs maximum
diagnose sys session stat
 
# Full session table statistics
diagnose sys session full-stat

# NP6/NP7 session offload statistics
diagnose npu np6 session-stats
# For NP7-based platforms:
diagnose npu np7 session-stats
 
# NP hardware session count
diagnose npu np6 sse-stats
 
# NP packet counters (drops, errors, throughput)
diagnose npu np6 port-list
 
# Check NP fast-path utilization
diagnose npu np6 dce
 
# Identify sessions NOT offloaded (and why)
diagnose npu np6 sse-stats | grep offload

# Real-time interface throughput (run for 10+ seconds to get stable readings)
diagnose netlink interface list
 
# Detailed interface counters -- packets, bytes, errors, drops
fnsysctl ifconfig <interface-name>
 
# Per-VDOM interface stats (if VDOMs enabled)
diagnose netlink interface list | grep -A5 <interface>

# CP utilization percentage
diagnose sys cps stats
 
# SSL offload statistics
diagnose vpn ssl stats
 
# IPS engine status and packet counts
diagnose ips session status

# See how many sessions are currently offloaded vs not
diagnose sys session stat
 
# Look for the "npu offloaded" line in output
# Example output:
#   misc info:    session_count=125000 setup_rate=850
#   npu offloaded: 98000
#   non-offloaded: 27000
 
# Check a specific session's offload status
diagnose sys session list | grep "npu_flag"
# npu_flag=set means offloaded, npu_flag=clear means CPU-processed
 
# Get the offload ratio
diagnose npu np6 session-stats

# Check global NP acceleration status
config system np6
    show
end
 
# Ensure NP offload is not disabled at the system level
config system settings
    show full | grep "np-offload"
end

config system np6
    set fastpath enable
end

# Check a specific policy for auto-asic-offload
config firewall policy
    edit <policy-id>
        show full | grep auto-asic-offload
    next
end
 
# Ensure auto-asic-offload is enabled (default is enable)
config firewall policy
    edit <policy-id>
        set auto-asic-offload enable
    next
end

# List sessions that are NOT offloaded
diagnose sys session list | grep "npu_flag=clear"
 
# For each non-offloaded session, check why
# Look for: proxy mode, traffic shaping, ALG, interface mismatch
diagnose sys session list | grep -B5 -A5 "npu_flag=clear" | head -100
 
# Check which interfaces map to which NP chip
diagnose npu np6 port-list
# Output shows each interface's NP assignment
# Interfaces on different NPs cannot offload sessions between them

# NP6-specific session statistics
diagnose npu np6 session-stats
 
# NP6 VXLAN offload (if using VXLAN)
config system np6
    set vxlan-offload enable
end
 
# NP6 IPsec offload verification
diagnose vpn ike gateway list | grep npu

# NP7 enhanced session statistics
diagnose npu np7 session-stats
 
# NP7 supports higher session counts and more offload features
# Verify NP7 capabilities
diagnose npu np7 dce
 
# NP7 hyperscale mode (for platforms that support it)
# Check if hyperscale is available and enabled
config system np7
    show
end

# View NP-to-interface mapping
diagnose npu np6 port-list
 
# Example output:
#   np6_0: port1 port2 port3 port4
#   np6_1: port5 port6 port7 port8
#   np6_2: port9 port10 npu0_vlink0 npu0_vlink1
 
# If your primary WAN is on np6_0 and primary LAN is on np6_1,
# traffic between them CANNOT be NP-offloaded between chips
# Solution: Re-cable so WAN and LAN are on the same NP chip

# After changes, re-check offload ratio
diagnose npu np6 session-stats
# Compare "offloaded" count to your baseline
 
# Monitor in real-time (run for 30+ seconds during peak)
diagnose sys session stat
# Look for npu offloaded count increasing relative to total sessions

# Check CP utilization
diagnose sys cps stats
 
# CP hardware status
diagnose hardware deviceinfo nic
 
# SSL offload statistics
diagnose vpn ssl stats

# Verify SSL inspection is using CP offload
config firewall ssl-ssh-profile
    edit "deep-inspection"
        show full | grep "ssl-offload"
    next
end
 
# Enable CP offload for SSL inspection (if not already set)
config system global
    set ssl-hw-acceleration enable
end

# Check IPS engine configuration
config ips global
    show
end
 
# Enable CP-accelerated IPS (default on supported platforms)
config ips global
    set cp-accel-mode advanced
end

# Check CP load distribution
diagnose sys cps stats
 
# If one CP is overloaded while others are idle, check SSL profile
# distribution and ensure traffic is not pinned to a single CP

# Re-check CP utilization
diagnose sys cps stats
 
# Compare to baseline -- CP utilization should increase
# (more work moved to CP = higher CP use but lower CPU use)
# CPU utilization should decrease correspondingly
get system performance status

# Current session count and maximum
diagnose sys session stat
 
# Example output:
#   misc info:    session_count=145000 setup_rate=1200
#   ...
#   session table size: 500000
 
# Check configured session table size
config system session-ttl
    show
end

# Increase session table size based on your platform's memory
# FortiGate 200F: default 2M, max depends on RAM
# FortiGate 600F: default 8M, max depends on RAM
# FortiGate 3000F: default 24M+
 
# Check maximum supported sessions for your platform
get hardware status
 
# Set session table size (requires reboot on some platforms)
config system session-ttl
    set default 3600
end

# View current TTL settings
config system session-ttl
    show
end
 
# Optimize TTLs for common protocols
config system session-ttl
    set default 3600
    config port
        # DNS -- queries are fast, reduce from default
        edit 1
            set protocol 17
            set start-port 53
            set end-port 53
            set timeout 30
        next
        # HTTP -- most pages load within seconds
        edit 2
            set protocol 6
            set start-port 80
            set end-port 80
            set timeout 600
        next
        # HTTPS -- slightly longer for complex web apps
        edit 3
            set protocol 6
            set start-port 443
            set end-port 443
            set timeout 1800
        next
        # ICMP -- ping should not hold sessions for minutes
        edit 4
            set protocol 1
            set start-port 0
            set end-port 65535
            set timeout 15
        next
        # NTP -- one-shot, reduce aggressively
        edit 5
            set protocol 17
            set start-port 123
            set end-port 123
            set timeout 15
        next
    end
end

# List active session helpers
config system session-helper
    show
end
 
# Disable session helpers for protocols you don't use
# Example: Disable SIP ALG if not using SIP through the FortiGate
config system session-helper
    delete <helper-id-for-sip>
end
 
# Or disable specific helpers
config system settings
    set sip-helper disable
    set sip-nat-trace disable
end

# Check session pickup status
config system ha
    show full | grep "session-pickup"
end
 
# Enable session pickup for critical protocols only
config system ha
    set session-pickup enable
    set session-pickup-connectionless enable
    set session-pickup-delay enable
end

# Enable asymmetric routing tolerance if needed
config system settings
    set asymroute enable
end
 
# For specific interfaces with known asymmetric paths
config system interface
    edit "wan1"
        set fail-detect enable
    next
end

# After TTL changes, monitor session count over time
diagnose sys session stat
# Session count should be lower for the same traffic load
# (faster TTL expiry = fewer stale sessions consuming entries)
 
# Check session setup rate (should remain stable)
# If setup rate drops, TTLs may be too aggressive
diagnose sys session stat | grep setup_rate

# Check current IPS sensor configuration
config ips sensor
    edit "high-performance"
        show
    next
end
 
# Create an optimized IPS sensor that targets your actual environment
config ips sensor
    edit "optimized-sensor"
        # Start with severity-based filtering
        config entries
            # Block critical and high severity -- these are the real threats
            edit 1
                set severity critical high
                set status enable
                set action block
                set log enable
            next
            # Log medium severity for visibility, but pass traffic
            edit 2
                set severity medium
                set status enable
                set action pass
                set log enable
            next
            # Disable low/info signatures -- they generate noise and CPU load
            edit 3
                set severity low info
                set status disable
            next
        end
    next
end

config ips sensor
    edit "optimized-sensor"
        config entries
            # Disable signatures for platforms not in your environment
            edit 4
                set os "Linux"
                set status disable
                # Only if you have NO Linux servers -- be careful here
            next
            # Disable client-side signatures if this is a server farm
            edit 5
                set application "Web_Client"
                set status disable
            next
        end
    next
end

# Check current AV profile
config antivirus profile
    edit "optimized-av"
        show
    next
end
 
# Flow-based scanning is 5-10x faster than proxy-based
config antivirus profile
    edit "optimized-av"
        set scan-mode quick
        set inspection-mode flow-based
        config http
            set av-scan enable
            set outbreak-prevention enable
        end
        config ftp
            set av-scan enable
        end
        config smtp
            set av-scan enable
        end
        # Disable scanning for protocols not in use
        config imap
            set av-scan disable
        end
        config pop3
            set av-scan disable
        end
    next
end

# Use FortiGuard category-based filtering (faster than URL-by-URL)
config webfilter profile
    edit "optimized-webfilter"
        set inspection-mode flow-based
        config ftgd-wf
            # Block categories by group rather than individual URLs
            config filters
                edit 1
                    set category 1
                    set action block
                next
                # ... configure category blocks ...
            end
        end
        # Disable URL rating for known-safe traffic (internal sites)
        set url-extraction-redirects disable
    next
end

# Application control -- use categories, not individual signatures
config application list
    edit "optimized-appctrl"
        config entries
            # Block high-risk categories
            edit 1
                set category 22  # P2P
                set action block
            next
            edit 2
                set category 19  # Proxy
                set action block
            next
            # Monitor (not block) general categories to reduce inspection depth
            edit 3
                set category 5  # General.Interest
                set action pass
                set log enable
            next
        end
    next
end

# Check current SSL inspection profile
config firewall ssl-ssh-profile
    edit "deep-inspection"
        show full
    next
end
 
# Optimize SSL inspection
config firewall ssl-ssh-profile
    edit "optimized-ssl"
        # Exempt trusted and high-bandwidth categories from inspection
        config exempt
            edit 1
                set fortiguard-category 31  # Finance/Banking
            next
            edit 2
                set fortiguard-category 33  # Health/Medicine
            next
            # Exempt CDN and update traffic (high volume, low risk)
            edit 3
                set address "Microsoft-365" "Google-Cloud" "AWS" "Akamai"
            next
        end
        # Use certificate inspection for exempted categories
        # (still validates certs without decrypting content)
        set ssl-exemptions-log enable
 
        # Tune TLS version support
        config https
            set ports 443
            set status deep-inspection
            set client-certificate bypass
        end
    next
end

# Check CPU impact before and after UTM changes
get system performance status
 
# Monitor IPS engine specifically
diagnose ips session status
 
# Check flow vs proxy session ratio
diagnose sys session stat
# Fewer proxy sessions = more efficient

# Identify your most-hit policies
diagnose firewall iprope lookup <src-ip> <dst-ip> <src-port> <dst-port> <protocol>
 
# View policy hit counts
get firewall policy | grep -A2 "policyid"
 
# Or use the GUI: Policy & Objects > Firewall Policy > Column Settings > Enable "Hit Count"
 
# Move high-hit policies to the top
config firewall policy
    move <high-hit-policy-id> before <first-policy-id>
end

# Before: 5 policies for different servers, same inspection profile
# Policy 10: srcaddr=any, dstaddr=WebServer1, service=HTTPS, action=accept
# Policy 11: srcaddr=any, dstaddr=WebServer2, service=HTTPS, action=accept
# Policy 12: srcaddr=any, dstaddr=WebServer3, service=HTTPS, action=accept
# Policy 13: srcaddr=any, dstaddr=WebServer4, service=HTTPS, action=accept
# Policy 14: srcaddr=any, dstaddr=WebServer5, service=HTTPS, action=accept
 
# After: 1 policy using an address group
config firewall addrgrp
    edit "WebServers"
        set member "WebServer1" "WebServer2" "WebServer3" "WebServer4" "WebServer5"
    next
end
 
config firewall policy
    edit <policy-id>
        set srcaddr "all"
        set dstaddr "WebServers"
        set service "HTTPS"
        set action accept
        set utm-status enable
        set auto-asic-offload enable
    next
end

# Interface-based approach (better for NP offload)
config firewall policy
    edit <policy-id>
        set srcintf "port1"
        set dstintf "port3"
        # NP can offload if port1 and port3 are on the same NP chip
    next
end
 
# Zone-based approach (fewer policies, easier management)
config system zone
    edit "LAN-zone"
        set interface "port3" "port4" "port5"
    next
end

# Create a business hours schedule
config firewall schedule recurring
    edit "business-hours"
        set day monday tuesday wednesday thursday friday
        set start 07:00
        set end 19:00
    next
end
 
# Apply full UTM during business hours, lighter inspection off-hours
config firewall policy
    edit <business-policy-id>
        set schedule "business-hours"
        set utm-status enable
        set ips-sensor "full-sensor"
        set av-profile "full-av"
    next
    edit <offhours-policy-id>
        set schedule "always"
        set utm-status enable
        set ips-sensor "optimized-sensor"
        set av-profile "optimized-av"
    next
end

# Enable policy caching (enabled by default, verify it is not disabled)
config system settings
    show full | grep "policy-auth-concurrent"
end
 
# Check policy count
get firewall policy | grep -c "policyid"
 
# If you have 500+ policies, consider:
# 1. Consolidating with address groups
# 2. Using VDOMs to segment policy tables
# 3. Removing disabled/unused policies

# View current SLA probes
config system sdwan
    config health-check
        show
    end
end
 
# Optimize probe frequency -- default 500ms is aggressive
config system sdwan
    config health-check
        edit "wan-sla"
            # Increase interval from 500ms to 1000ms for less overhead
            set interval 1000
            # Reduce probe count (default 30 is high)
            set probe-count 10
            # Use appropriate protocol
            set protocol ping
            set server "8.8.8.8" "1.1.1.1"
            # Set failure threshold
            set failtime 3
            # Set recovery threshold
            set recoverytime 5
        next
    end
end

config system sdwan
    config health-check
        edit "wan-sla"
            config sla
                edit 1
                    # Latency threshold in ms
                    set latency-threshold 100
                    # Jitter threshold in ms
                    set jitter-threshold 30
                    # Packet loss threshold in percent
                    set packetloss-threshold 2
                next
                edit 2
                    # Degraded SLA -- still usable but not preferred
                    set latency-threshold 200
                    set jitter-threshold 50
                    set packetloss-threshold 5
                next
            end
        next
    end
end

config system sdwan
    config service
        edit 1
            set name "critical-apps"
            # source-ip-based: consistent hashing, same source always same path
            # Best for: most environments, session persistence
            set load-balance-mode source-ip-based
 
            # volume-based: distribute by bandwidth consumption
            # Best for: environments with mixed large/small flows
            # set load-balance-mode volume-based
 
            # session-based: round-robin per session
            # Best for: many small sessions, maximum distribution
            # set load-balance-mode sessions
 
            # source-dest-ip-based: hash on both src and dst
            # Best for: environments needing session affinity
            # set load-balance-mode source-dest-ip-based
        next
    end
end

config system sdwan
    config service
        # Rule 1: VoIP -- most latency sensitive, most specific
        edit 1
            set name "voip"
            set dst "voip-servers"
            set internet-service enable
            set internet-service-app-ctrl 41468  # Microsoft Teams
            set priority-members 1  # Best latency link
            set sla "wan-sla"
            set sla-compare-method number
        next
        # Rule 2: Critical SaaS
        edit 2
            set name "saas-critical"
            set internet-service enable
            set internet-service-app-ctrl 16354 16355  # M365
            set load-balance-mode source-ip-based
        next
        # Rule 3: General traffic (catch-all)
        edit 3
            set name "default"
            set dst "all"
            set load-balance-mode source-ip-based
        next
    end
end

# Check SD-WAN link quality
diagnose sys sdwan health-check
 
# Verify traffic distribution
diagnose sys sdwan service
 
# Monitor SLA status
diagnose sys sdwan intf-sla-log
 
# Check for unnecessary failovers (flapping)
diagnose sys sdwan log

# Check current memory status and thresholds
diagnose hardware sysinfo memory
 
# View conserve mode history
diagnose sys top 1 20
 
# Check if currently in conserve mode
get system performance status | grep "Memory"
# Look for: "Memory states: normal" (good) vs "Memory states: conserve" (bad)
 
# View conserve mode thresholds
config system global
    show full | grep conserve
end

# Adjust thresholds (use with caution)
config system global
    # Memory watermark thresholds
    set av-failopen pass
    set ips-affinity "0"
end
 
# Set proxy resource limits to prevent proxy from consuming all memory
config firewall profile-protocol-options
    edit "optimized"
        config http
            # Limit oversized HTTP content (prevents memory exhaustion)
            set oversize-limit 10
            set uncompressed-oversize-limit 12
        end
        config ftp
            set oversize-limit 10
            set uncompressed-oversize-limit 12
        end
    next
end

# Real-time memory breakdown
diagnose sys top 1 30
 
# Check which processes consume the most memory
diagnose sys process list | sort -rn -k 4 | head 20
 
# Monitor proxy memory usage specifically
diagnose test application wad 1
 
# Session memory usage
diagnose sys session stat | grep "memory"
 
# Check for memory leaks (increasing usage without corresponding session increase)
# Run periodically and compare:
diagnose hardware sysinfo memory

# Limit memory available to proxy daemons
config system global
    # Set proxy memory limit as percentage of total memory
    set proxy-resource-mode enable
end
 
# Tune individual proxy limits
config firewall profile-protocol-options
    edit "optimized"
        config http
            set oversize-limit 10
            set uncompressed-oversize-limit 12
            # Block oversized content rather than buffering it
            set block-page-status-code 403
        end
    next
end

# Set SNMP memory threshold trap
config system snmp sysinfo
    set status enable
end
config system snmp community
    edit 1
        set events cpu-high mem-low
    next
end

# Check current MTU on all interfaces
get system interface | grep mtu
 
# Set optimal MTU (typically 1500 for Ethernet, 9000 for jumbo frames)
config system interface
    edit "port1"
        # Standard Ethernet MTU
        set mtu 1500
        # Override default MTU if path supports jumbo frames
        set mtu-override enable
        # For data center internal traffic:
        # set mtu 9000
    next
end

# Set TCP MSS clamping on VPN interfaces
config vpn ipsec phase1-interface
    edit "to-azure"
        set auto-negotiate enable
    next
end
 
# Per-policy MSS clamping
config firewall policy
    edit <vpn-policy-id>
        set tcp-mss-sender 1350
        set tcp-mss-receiver 1350
    next
end

# Check interface flow control
get system interface physical | grep flow
 
# Enable flow control to prevent packet drops at ingress
config system interface
    edit "port1"
        set speed auto
        set pause-meter-rate 0
    next
end
 
# For high-throughput interfaces, verify duplex and speed
config system interface
    edit "port1"
        show full | grep speed
        # Ensure auto-negotiation is working or force speed if needed
        # set speed 10000full  # Force 10G full duplex
    next
end

# Create an LACP aggregate interface
config system interface
    edit "agg1"
        set type aggregate
        set member "port1" "port2"
        set lacp-mode active
        set lacp-ha-slave disable
        set min-links 1
        set algorithm L3  # Hash based on src/dst IP for better distribution
        # L4 for src/dst IP + port (best distribution for mixed traffic)
        # set algorithm L4
    next
end

# Configure ECMP with multiple static routes
config router static
    edit 1
        set dst 0.0.0.0/0
        set gateway 10.0.1.1
        set device "port1"
        set distance 10
    next
    edit 2
        set dst 0.0.0.0/0
        set gateway 10.0.2.1
        set device "port2"
        set distance 10
    next
end
 
# Set ECMP load balancing method
config system settings
    # source-ip-based (default, recommended)
    set ecmp-max-paths 4
end
 
# Verify ECMP is active
get router info routing-table all | grep "0.0.0.0"
# Should show multiple equal-cost routes

# Check routing table size
get router info routing-table details | wc -l
 
# For BGP environments, implement route aggregation
config router bgp
    config aggregate-address
        edit 1
            set prefix 10.0.0.0 255.0.0.0
        next
    end
end
 
# Set appropriate route cache timeout
config system global
    set ip-src-port-range 1024-25000
end

# Check current logging configuration
show log setting
show log fortianalyzer setting
show log syslogd setting
show log disk setting
 
# Recommended: Log to FortiAnalyzer or syslog, not local disk
# Local disk logging creates I/O bottlenecks on high-throughput devices
config log disk setting
    set status disable
    set max-log-file-size 100
end
 
# FortiAnalyzer logging (recommended)
config log fortianalyzer setting
    set status enable
    set server <faz-ip>
    set enc-algorithm high
    set reliable enable
    set upload-option realtime
end
 
# If using syslog as alternative
config log syslogd setting
    set status enable
    set server <syslog-ip>
    set port 514
    set facility local7
    set format rfc5424
end

# Log only denied traffic and UTM events (not all allowed traffic)
config firewall policy
    edit <high-volume-allow-policy>
        set logtraffic utm
        # Options:
        # all -- log every session (highest overhead)
        # utm -- log only UTM events (moderate overhead, good visibility)
        # disable -- no logging (lowest overhead, bad visibility)
    next
end
 
# For high-volume internal policies, consider logging only at session start
config firewall policy
    edit <internal-policy>
        set logtraffic utm
        set logtraffic-start disable
    next
end
 
# Reduce severity level for routine traffic
config log setting
    set fwpolicy-implicit-log enable
    set local-in-allow disable
    set local-in-deny-broadcast disable
    set local-in-deny-unicast disable
    set log-invalid-packet disable
end

# Top processes by CPU
diagnose sys top 1 20
 
# Real-time throughput per interface
diagnose netlink interface list
 
# Packet flow debug (use sparingly -- this impacts performance!)
diagnose debug flow filter addr <suspect-ip>
diagnose debug flow show function-name enable
diagnose debug flow trace start 100
# IMPORTANT: Always stop the trace when done
diagnose debug flow trace stop
diagnose debug disable
 
# Crash log check (performance issues sometimes correlate with crashes)
diagnose debug crashlog read
 
# Hardware sensor readings (thermal throttling check)
execute sensor list
 
# NP error counters
diagnose npu np6 sse-stats | grep -i error
diagnose npu np6 sse-stats | grep -i drop

# Check log generation rate
execute log filter device memory
execute log display
# Look at timestamps -- high-volume logging will show hundreds of entries per second
 
# Compare CPU before and after logging changes
get system performance status

# Collect the same metrics as your pre-optimization baseline
 
# System performance
get system performance status
 
# CPU breakdown
diagnose sys top 1 20
 
# Memory status
diagnose hardware sysinfo memory
 
# Session statistics
diagnose sys session stat
 
# NP offload ratio
diagnose npu np6 session-stats
 
# CP utilization
diagnose sys cps stats
 
# Interface throughput
diagnose netlink interface list
 
# Verify no conserve mode events
get system performance status | grep "Memory"

# Configure SNMP monitoring for CPU/memory thresholds
config system snmp sysinfo
    set status enable
    set engine-id "local"
    set contact-info "noc@yourcompany.com"
end
 
config system snmp community
    edit 1
        set name "<community-string>"
        set events cpu-high mem-low log-full intf-ip fm-conf-change
        config hosts
            edit 1
                set ip <monitoring-server-ip> 255.255.255.255
            next
        end
    next
end
 
# Enable performance logging to FortiAnalyzer
config log fortianalyzer setting
    set status enable
    set upload-option realtime
end

# Confirm IPS is still active and detecting
diagnose ips session status
 
# Verify AV engine is running and updating
diagnose autoupdate status
diagnose autoupdate versions
 
# Check SSL inspection is functional
diagnose test application ssl 1
 
# Verify firewall policies are still matching correctly
diagnose firewall iprope lookup <test-src-ip> <test-dst-ip> <port> <port> <proto>

# Check NP health
diagnose npu np6 sse-stats
# Look for error counters, session table full, or hardware errors
 
# Verify interface-to-NP mapping
diagnose npu np6 port-list
# Ensure ingress and egress interfaces are on the same NP
 
# Check for NP session table exhaustion
diagnose npu np6 session-stats | grep "max"
# If current count is near max, the NP session table is full
 
# Check policy settings
config firewall policy
    edit <policy-id>
        show full | grep auto-asic-offload
    next
end
# Ensure auto-asic-offload is "enable"

# Check current memory state
get system performance status
 
# Identify memory consumers
diagnose sys top 1 30
# Look for processes using >20% memory: wad (proxy), ipsengine, scanunitd
 
# Check session count (excessive sessions consume memory)
diagnose sys session stat
 
# Check for memory leaks
diagnose hardware sysinfo memory
# Run multiple times over 10 minutes -- if usage only goes up, leak suspected

# Check session count vs maximum
diagnose sys session stat
# If session_count is at or near the maximum, the table is full
 
# Identify what is filling the session table
diagnose sys session list | awk '{print $4}' | sort | uniq -c | sort -rn | head 20
# This shows source IPs with the most sessions -- could indicate a scan or worm
 
# Check for session table DoS
diagnose sys session stat | grep "clash"
# High clash count indicates hash table collisions (possible DoS)

config firewall DoS-policy
    edit 1
        set interface "wan1"
        config anomaly
            edit "tcp_src_session"
                set status enable
                set action block
                set threshold 1000
            next
        end
    next
end

# Check for asymmetric routing indicators in logs
execute log filter field subtype forward
execute log filter field action deny
execute log display
 
# Look for "reverse path check fail" or "no matching policy" for traffic
# that should be allowed
 
# Enable loose RPF (Reverse Path Forwarding) check
config system settings
    set strict-src-check disable
end
 
# Or enable asymmetric routing
config system settings
    set asymroute enable
end

# Check SLA status history
diagnose sys sdwan health-check
 
# Look for rapid state changes
diagnose sys sdwan intf-sla-log
 
# Check if thresholds are too tight
config system sdwan
    config health-check
        edit "wan-sla"
            show
        next
    end
end

config system sdwan
    config health-check
        edit "wan-sla"
            set failtime 5
            set recoverytime 10
            set interval 1000
        next
    end
end

# Check IPS engine status
diagnose ips session status
 
# Identify which signatures are firing most
diagnose ips anomaly list
 
# Check if IPS database is current
diagnose autoupdate versions | grep -A3 "IPS"

config ips sensor
    edit "optimized-sensor"
        config entries
            edit <entry-id>
                config exempt-ip
                    edit 1
                        set src-ip <legitimate-source>
                    next
                end
            next
        end
    next
end